Cal. Education Code § 56515

(a) In addition to the provisions of Chapter 6.5 (commencing with Section 49060) of Part 27, the confidentiality of personally identifiable information about individuals with exceptional needs shall be governed and protected in accordance with Sections 1412(a)(8) and 1417(c) of Title 20 of the United States Code and Part 300 (commencing with Section 300.1) of Title 34 of the Code of Federal Regulations, including Sections 300.611 to 300.626, inclusive, covering notice to parents, access rights, records of access, records on more than one child, list of types and locations of information, fees, amendment of records at parent’s request, opportunity for a hearing, result of hearing, hearing procedures, consent, destruction of information, children’s privacy rights, and enforcement, and Section 1413(i) of Title 20 of the United States Code and Section 300.229 of Title 34 of the Code of Federal Regulations, regarding disciplinary information. (b) Pursuant to Section 300.32 of Title 34 of the Code of Federal Regulations, “personally identifiable,” as used in this part, includes all of the following information: (1) The name of the child, the parent of the child, or other family member. (2) The address of the child. (3) A personal identifier, including, but not limited to, the social security number of the child, a pupil number, a list of personal characteristics, or other information that would make it possible to identify the child with reasonable certainty. (c) (1) In accordance with Section 300.622 of Title 34 of the Code of Federal Regulations, parental consent shall be obtained before personally identifiable information is disclosed to the parties, other than officials of participating agencies in accordance with Section 300.622(b)(1) of Title 34 of the Code of Federal Regulations, unless the information is contained in education records, and the disclosure is authorized without parental consent under Part 99 (commencing with Section 99.1) of Title 34 of the Code of Federal Regulations. Except as provided in paragraphs (2) and (3), parental consent is not required before personally identifiable information is released to officials of participating agencies for purposes of meeting a requirement of this part or Part 300 (commencing with Section 300.1) of Title 34 of the Code of Federal Regulations. (2) Parental consent, or the consent of an eligible child who has reached the age of 18 years, shall be obtained before personally identifiable information is released to officials of participating agencies providing or paying for transition services in accordance with Section 300.321(b)(3) of Title 34 of the Code of Federal Regulations. (3) If a child is enrolled, or is going to enroll in a private school that is not located in the local educational agency of the residence of the parent, parental consent shall be obtained before any personally identifiable information about the child is released between officials in the local educational agency where the private school is located and officials in the local educational agency of the residence of the parent.